Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    32s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 12:03

General

  • Target

    227fbd8589ba588cad7a510f80de01700feaa200a6fe51f8da3f64fd05c5c32d.exe

  • Size

    736KB

  • MD5

    6528c3c8a13408336f6d52727b0b7a53

  • SHA1

    16fb57f0c7c0dd2d85eff25114b5b8093fd0d085

  • SHA256

    227fbd8589ba588cad7a510f80de01700feaa200a6fe51f8da3f64fd05c5c32d

  • SHA512

    31a459d148dd88b5d4da069871f85c358563e975d82c8e4b890c292f809004f4500a61d7562e91071f0adaed44f115baa96a89eae2d4f41f1bb44a1cb8b93a41

  • SSDEEP

    12288:gpQFKc84EnyLz1emmZ+kEOc4dYchfL7pNWZQZrJe2WhmbP:gpQAcnLzY7EP6PhfLziQMhhmbP

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\227fbd8589ba588cad7a510f80de01700feaa200a6fe51f8da3f64fd05c5c32d.exe
    "C:\Users\Admin\AppData\Local\Temp\227fbd8589ba588cad7a510f80de01700feaa200a6fe51f8da3f64fd05c5c32d.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun0.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1364
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        3⤵
          PID:980
        • C:\Windows\SysWOW64\cacls.exe
          cacls "C:\Users\Admin\Desktop\Internet Explorer.lnk" /G Everyone:R /C
          3⤵
            PID:672
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun9.bat" "
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1788
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            3⤵
              PID:812
            • C:\Windows\SysWOW64\cacls.exe
              cacls "C:\Program Files (x86)\Internet Explorer\ie\iexplore.exe" /G Everyone:R /C
              3⤵
                PID:804
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun49.bat" "
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1664
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                3⤵
                  PID:1748
                • C:\Windows\SysWOW64\cacls.exe
                  cacls "C:\Users\Admin\Desktop\Internet Explorer.lnk" /G Everyone:R /C
                  3⤵
                    PID:1412
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun67.bat" "
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1276
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    3⤵
                      PID:776
                    • C:\Windows\SysWOW64\cacls.exe
                      cacls "C:\Program Files (x86)\Internet Explorer\ie\iexplore.exe" /G Everyone:R /C
                      3⤵
                        PID:896
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun70.bat" "
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1660
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        3⤵
                          PID:1524
                        • C:\Windows\SysWOW64\cacls.exe
                          cacls "C:\Users\Admin\Desktop\Internet Explorer.lnk" /G Everyone:R /C
                          3⤵
                            PID:1512
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun27.bat" "
                          2⤵
                            PID:1120
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                              3⤵
                                PID:1304
                              • C:\Windows\SysWOW64\cacls.exe
                                cacls "C:\Users\Admin\Desktop\Internet Explorer.lnk" /G Everyone:R /C
                                3⤵
                                  PID:1092
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun10.bat" "
                                2⤵
                                  PID:1952
                                  • C:\Windows\SysWOW64\cacls.exe
                                    cacls "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\Launch Internet Explorer Browser.lnk" /G Everyone:R /C
                                    3⤵
                                      PID:932
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                      3⤵
                                        PID:760
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun74.bat" "
                                      2⤵
                                        PID:1332
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                          3⤵
                                            PID:908
                                          • C:\Windows\SysWOW64\cacls.exe
                                            cacls "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\Launch Internet Explorer Browser.lnk" /G Everyone:R /C
                                            3⤵
                                              PID:1508
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun38.bat" "
                                            2⤵
                                              PID:1964
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                3⤵
                                                  PID:1560
                                                • C:\Windows\SysWOW64\cacls.exe
                                                  cacls "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\╞⌠╢» Internet Explorer Σ»└└╞≈.lnk" /G Everyone:R /C
                                                  3⤵
                                                    PID:1676

                                              Network

                                              MITRE ATT&CK Enterprise v6

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Program Files (x86)\Internet Explorer\ie\iexplore.exe

                                                Filesize

                                                787KB

                                                MD5

                                                c8a8321292a459b0a17fb39a782a5c74

                                                SHA1

                                                ef08e68af5b52c468a905a016ddbfb7c5b0a62e6

                                                SHA256

                                                a214e3b654bcb6e6142e101b0e89081d44a3a634afa94dc0a620467335b7beb2

                                                SHA512

                                                e43131e59ad638445d041753b3711a261134b7a557c10a462ed26c8db72c90814e561013b8b57fc64be5f9339eba875e14f48af54f0218735e6733227c264553

                                              • C:\Users\Admin\AppData\Local\Temp\srun0.bat

                                                Filesize

                                                129B

                                                MD5

                                                d057bfbe3c4586e09f07782151190318

                                                SHA1

                                                ce11f3d86de7dd847a24099c325ec71157c67165

                                                SHA256

                                                5321ee07e36544d77342ae988e5689506f6dd39db71a6533b23feae4f8613575

                                                SHA512

                                                3ef6dd46de45158bea3cc9a9e43b8a13f5590aef4a994a5de280ac9b34ebe183675ae875d086a068754bcd265e2f458f106759cddb84592ee096a63405d27e51

                                              • C:\Users\Admin\AppData\Local\Temp\srun10.bat

                                                Filesize

                                                195B

                                                MD5

                                                e399afd9b2bcabe55c1cd7aa1f93265d

                                                SHA1

                                                beffa7b821bf02185189d5d03eb0b50ec143b469

                                                SHA256

                                                0dea9c7a291c5b6d9bcdb554385d993c333efeefaba42d1e40876d4bfbc0be47

                                                SHA512

                                                237470e394d0441b21e306bf8fe8dfccb3c6af1a06cc56b33526130e5a8281136a3904de958f116849b769f930b1b304a433cf714388fcc991c824312d9abaa5

                                              • C:\Users\Admin\AppData\Local\Temp\srun27.bat

                                                Filesize

                                                130B

                                                MD5

                                                01952fb43a17b3e3458094a8b572c44d

                                                SHA1

                                                174fa3878c5cea040914332caedca8a3ad066a77

                                                SHA256

                                                d2fe098b420cb715c75aebf06e559372de72979fce5039c50f9c23d78b64c746

                                                SHA512

                                                7336f1649871a4a2b7c8b848efb61aeb2255b765ba3ba5f27a7e36f6764b7bcdcf15e8a1d13ab4847315dc882edbfd5862d85a5ceaa0c036aaad94ec2427611c

                                              • C:\Users\Admin\AppData\Local\Temp\srun38.bat

                                                Filesize

                                                191B

                                                MD5

                                                cb5f2dcdaff71b8af3d5e07bd50d8dcd

                                                SHA1

                                                efc71b68f0dce33f6edbb626bc1d8540bca4274a

                                                SHA256

                                                41347b8fd9d3ab39fcfee5959ea207f907850687ea67ed70654d881bea0a4b67

                                                SHA512

                                                dc2ff15d3b5f9ec5c8e628571ffa79f626ed47b871efa0997d587a485b4c9c602a2c5ce7c3c7c703c13849fda107c712cbcbc36fc092260c02b80973754bf0c0

                                              • C:\Users\Admin\AppData\Local\Temp\srun49.bat

                                                Filesize

                                                130B

                                                MD5

                                                d47ca0b09132e2956ddad2989c4e2d94

                                                SHA1

                                                99e70f1cb597ba904b347e80179e2456cdd13dec

                                                SHA256

                                                5efc405042e9394ee2e19496627aef172eb26040b8b19afe4a8eed31f6127d96

                                                SHA512

                                                44af7392be5c8aa878b7c7ff5a1d93d945d361788d1b8fee9bb24b83e95a5c98bebd7ed78d52d5f7479cd5a087c523fda39751e21c742ca059f962dd47bda067

                                              • C:\Users\Admin\AppData\Local\Temp\srun67.bat

                                                Filesize

                                                142B

                                                MD5

                                                a5d4efce363d0d459fc3b420db454297

                                                SHA1

                                                ec5dc7b63a4268a0b6c61289dce4665b60560690

                                                SHA256

                                                c2bde47d854c665b0f7a5541f29c74c401f3c52598f1943953737a182a9c187d

                                                SHA512

                                                d8ceb8b8df2a0ea6c4b98ee1000bc733f42faff4d69a737d2155292215dd28829881e1130110002cd0836325f49926e49713e1e387a04601b482bc21e2cd664b

                                              • C:\Users\Admin\AppData\Local\Temp\srun70.bat

                                                Filesize

                                                130B

                                                MD5

                                                b5bc2b04290c13711d4cffecaefbf568

                                                SHA1

                                                feaf43402401a1638762a9e8c5647e249604e13c

                                                SHA256

                                                e81d6224badd3560083e25c29e8013d801c5d7cac174e9fdb942e806f3ce8113

                                                SHA512

                                                9a56c18d5ac835e920adc0081e867f804fb575946eef7d75fa13260bf7c35e8be778204745bb9f906e7135b31f7abcc977115a9af21d1d5ad9f821842ab4f472

                                              • C:\Users\Admin\AppData\Local\Temp\srun74.bat

                                                Filesize

                                                195B

                                                MD5

                                                5c64aa7c2b0f97c7ad99ed2cdc67888e

                                                SHA1

                                                4a57b23f528a1a1b0d64eadcc19f1ab49eb2d6a0

                                                SHA256

                                                f0d0088f66545698b979cfdc3009f9d7c33794ed7e6f4ae9ed838fefe1289173

                                                SHA512

                                                0fbc2acc6fdbb7477266ffa748e5e02dfaee12a11bba6405cf4b43cb80b9161a0602b079bdee147108418403b00d5ffa7f02f40436074351fa70e9bab81f25f0

                                              • C:\Users\Admin\AppData\Local\Temp\srun9.bat

                                                Filesize

                                                141B

                                                MD5

                                                0246fd5e3b66642371414a38de906740

                                                SHA1

                                                8f3a32f306c4dcc3bed9c903b54e191b1d1d9746

                                                SHA256

                                                48f464f14da60008e310fd8c5aec3eb5fdb1f4b290907963295cfe795784f7e3

                                                SHA512

                                                449c435bf44d7201d015268f6f431050b1b258cdc45857a97f8233d1bc6595063eff1fd3cdbbabf15038e11826818edc05ba185a7df5d5493198690581278625

                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

                                                Filesize

                                                1KB

                                                MD5

                                                622bf57680ede615156fe25332c36110

                                                SHA1

                                                6b0217f1912af59f9b6f69500c2436b30f9acc73

                                                SHA256

                                                b63d2565c91412ad7e71c52dff7a14a3d11d9029d94fd3b3313b41d51e5f6788

                                                SHA512

                                                404ce47cf704cda2342f9d886f74e9df12d067b157e656bb6fecf96e603f34211c8d307542ac9870f4f70e7fa1fd6d6aeee3e984e3d9a8a14c9b44428239bad0

                                              • C:\Users\Admin\Desktop\Internet Explorer.lnk

                                                Filesize

                                                1KB

                                                MD5

                                                34cd17c5b61d18697f1dcdf856a3056e

                                                SHA1

                                                349e5864229ba72f34f3733ec4c25f557e8f9314

                                                SHA256

                                                9017ea67a6d01bb98fa6a4592b9e0a43ce263a48ad3213066852f2234a373b13

                                                SHA512

                                                0725cc1365c4e2b61e1b69378e9ec8385fddc8f8f3e35972f18c53404c8b2ba9dbe6696d42bde359df0daf465cdbad60611c47c8f73736363dcf6bd39b2cc74a

                                              • memory/1912-54-0x0000000076031000-0x0000000076033000-memory.dmp

                                                Filesize

                                                8KB